@@ -543,55 +543,44 @@ def _get_encrypted_fields(
543543 master_key = connection .settings_dict .get ("KMS_CREDENTIALS" , {}).get (kms_provider )
544544 client_encryption = getattr (self .connection , "client_encryption" , None )
545545
546- def _field_dict (bson_type , path , new_key_alt_name , queries = None ):
547- """Helper to generate a dictionary for an encrypted field.
548- Included in parent function's scope to avoid passing parameters.
549- """
550- data_key = self ._get_data_key (
551- client_encryption ,
552- key_vault_collection ,
553- create_data_keys ,
554- kms_provider ,
555- master_key ,
556- new_key_alt_name ,
557- )
558- field_dict = {
559- "bsonType" : bson_type ,
560- "path" : path ,
561- "keyId" : data_key ,
562- }
563- if queries :
564- field_dict ["queries" ] = queries
565- return field_dict
566-
567546 field_list = []
568547
569548 for field in fields :
570549 new_key_alt_name = f"{ key_alt_name } .{ field .column } "
571550 path = f"{ path_prefix } .{ field .column } " if path_prefix else field .column
572551
573- if isinstance (field , (EmbeddedModelField , EmbeddedModelArrayField )):
574- if getattr (field , "encrypted" , False ):
575- bson_type = "object" if isinstance (field , EmbeddedModelField ) else "array"
576- field_list .append (
577- _field_dict (
578- bson_type , path , new_key_alt_name , getattr (field , "queries" , None )
579- )
580- )
581- else :
582- embedded_result = self ._get_encrypted_fields (
583- field .embedded_model ,
584- create_data_keys = create_data_keys ,
585- key_alt_name = new_key_alt_name ,
586- path_prefix = path ,
587- )
588- if embedded_result :
589- field_list .extend (embedded_result ["fields" ])
590- elif getattr (field , "encrypted" , False ):
552+ if isinstance (field , (EmbeddedModelField , EmbeddedModelArrayField )) and not getattr (
553+ field , "encrypted" , False
554+ ):
555+ embedded_result = self ._get_encrypted_fields (
556+ field .embedded_model ,
557+ create_data_keys = create_data_keys ,
558+ key_alt_name = new_key_alt_name ,
559+ path_prefix = path ,
560+ )
561+ if embedded_result :
562+ field_list .extend (embedded_result ["fields" ])
563+ continue
564+
565+ if getattr (field , "encrypted" , False ):
591566 bson_type = field .db_type (connection )
592- field_list .append (
593- _field_dict (bson_type , path , new_key_alt_name , getattr (field , "queries" , None ))
567+ data_key = self ._get_data_key (
568+ client_encryption ,
569+ key_vault_collection ,
570+ create_data_keys ,
571+ kms_provider ,
572+ master_key ,
573+ new_key_alt_name ,
594574 )
575+ field_dict = {
576+ "bsonType" : bson_type ,
577+ "path" : path ,
578+ "keyId" : data_key ,
579+ }
580+ queries = getattr (field , "queries" , None )
581+ if queries :
582+ field_dict ["queries" ] = queries
583+ field_list .append (field_dict )
595584
596585 return {"fields" : field_list } if field_list else None
597586
0 commit comments